Vulnerability Description
Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malicious SQL code through the rowid POST parameter to extract sensitive database information using error-based SQL injection techniques.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dolibarr | Dolibarr Erp\/Crm | <= 8.0.4 |
Related Weaknesses (CWE)
References
- https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/8.0.4/dolibarProduct
- https://www.dolibarr.org/Product
- https://www.exploit-db.com/exploits/46095ExploitVDB Entry
- https://www.vulncheck.com/advisories/dolibarr-erp-crm-sql-injection-via-rowid-paThird Party Advisory
FAQ
What is CVE-2019-25710?
CVE-2019-25710 is a vulnerability with a CVSS score of 8.2 (HIGH). Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malici...
How severe is CVE-2019-25710?
CVE-2019-25710 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-25710?
Check the references section above for vendor advisories and patch information. Affected products include: Dolibarr Dolibarr Erp\/Crm.